Analysis
-
max time kernel
180s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 04:41
General
-
Target
05ba25a02dacce0d5516e22623156649.doc
-
Size
1.3MB
-
MD5
05ba25a02dacce0d5516e22623156649
-
SHA1
85551c311f2b3c8e2bb4fd2394236b0d8a18bb13
-
SHA256
2343ad8cbaec4cfc723e45aff2d9bd2da9ad95f13c846a339f9ffa2ce0c58ec4
-
SHA512
396bd6593e8f44362db4b82a824cb3e6ef8e7aa8bb479d6f148185f56d3f82626fddd201c8f1d7afca80b2dbac65a6f50368634dce1ecfc880a48d9110f90e1c
-
SSDEEP
24576:PUCl6aRO77PRSBDu+SKxbFtnvXPHidJIw+ZdJOpvsviIFTP7ZGDT7U+:hl8bKftvXPHid+HnJOpPI5gDT7U+
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\05ba25a02dacce0d5516e22623156649.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB